feat: webhook integration, markdown parser, decentralized storage & multi-sig timelock

[adeniran19-maker]

Summary

This PR implements all four requested features in a single submission, ready for maintainer review and merge.

Closes #682
Closes #676
Closes #681
Closes #691

---

Changes by Issue

#682 — Webhook Integration for Lesson Completions

• Added WebhookSubscription model to Prisma schema (workspaceId, url, secret, events JSON array, active, timestamps)
• Added StudentActivity model for webhook event payloads
• Exposed 3 new REST endpoints under /api/v1/webhooks/subscriptions:
  • POST /api/v1/webhooks/subscriptions — create a subscription
  • GET /api/v1/webhooks/subscriptions — list subscriptions for workspace
  • DELETE /api/v1/webhooks/subscriptions/:id — delete a subscription
• updateStudentProgress now fires a lesson.completed webhook event (via the existing enqueueWebhookDeliveries dispatcher) whenever a student completes a lesson for the first time
• Tests: tests/webhooks.routes.test.ts — 5/5 pass

#676 — Markdown/MDX Content Parser Service

• New service src/services/markdownParser.service.ts using marked v15 for Markdown compilation and sanitize-html for XSS prevention
• Strips MDX JSX tags (<Component />) before parsing
• Extracts code blocks into a structured array
• Computes readingTimeMinutes from word count
• Returns { html, codeBlocks, readingTimeMinutes }
• Tests: tests/markdownParser.service.test.ts — 5/5 pass

#681 — Decentralized Storage Endpoint for Lesson Content

• New route GET /api/v1/learning/courses/:courseId/lessons/:lessonId/content
• Resolves IPFS CID from DecentralizedAsset table in the database
• Fetches content from configurable IPFS_GATEWAY_URL (e.g. Pinata, Cloudflare)
• Parses Markdown content through MarkdownParserService
• Caches parsed result in Redis for 1 hour to avoid repeated gateway calls
• Tests: tests/learning.content.test.ts — 2/2 pass

#691 — Multi-Sig Timelock Contract (Soroban SDK v22)

• Added multisig_wallet_timelock crate to the contracts workspace
• Full Soroban SDK v22 compatible implementation:
  • submit_proposal(payload, threshold, delay) — creates a pending proposal
  • approve_proposal(proposal_id) — signers vote; auto-executes at threshold
  • execute_proposal(proposal_id) — manual execution after timelock delay
  • get_proposal(proposal_id) — read proposal state
  • Authorization via require_auth() (replaces deprecated env.invoker())
  • Bytes storage for payloads (SDK v22 requirement, replaces Vec<u8>)
• Tests: 9 tests covering full lifecycle — all pass via cargo test -p multisig-wallet-timelock

---

Additional Fixes

• Fixed pre-existing Soroban SDK v22 test failures in proxy contract (proxy/src/tests.rs): update_current_contract_wasm requires the WASM hash to exist on the test ledger. Replaced dummy byte arrays with env.deployer().upload_contract_wasm() using the compiled proxy.wasm artifact — 6/6 proxy tests now pass
• Fixed smart_vault tests that panicked with Error(Storage, InternalError): Accessed contract instance key that has been archived — reduced ledger sequence increments to remain within the Soroban test environment's default TTL window — 9/9 smart_vault tests now pass
• Made PostgreSQL SSL connection optional for local/test environments in src/db/index.ts

---

Test Results

Backend (Jest)

PASS tests/markdownParser.service.test.ts  (5/5)
PASS tests/webhooks.routes.test.ts         (5/5)
PASS tests/learning.content.test.ts        (2/2)
PASS tests/progress.unit.test.ts           (21/21)

Contracts (cargo test --workspace)

test result: ok. 9 passed  — multisig_wallet_timelock
test result: ok. 6 passed  — proxy
test result: ok. 9 passed  — smart_vault
test result: ok. 8 passed  — payment_streaming
test result: ok. 6 passed  — commit_reveal_rng
(all other workspace crates: ok)

[vercel]

@rhoggs-bot-test-account is attempting to deploy a commit to the Ayomide Adeniran's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@adeniran19-maker Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits